cnvd - cnvd-2018-12574

cnvd-2018-12574

Vulnerability from cnvd

Title: Microsoft Windows Wireless Network Profile本地信息泄露漏洞

Description:

Microsoft Windows 10等都是美国微软（Microsoft）公司发布的一系列操作系统。Microsoft Windows 10是一套个人电脑使用的操作系统。Windows Server 2016是一套服务器操作系统。

Microsoft Windows Wireless Network Profile存在本地信息泄露漏洞，该漏洞源于程序允许普通用户访问管理用户的无线局域网配置文件。本地攻击者可通过登录受影响系统并运行命令利用该漏洞访问无线局域网配置文件（包括：密码）。

Severity: 低

Patch Name: Microsoft Windows Wireless Network Profile本地信息泄露漏洞的补丁

Patch Description:

Microsoft Windows Wireless Network Profile存在本地信息泄露漏洞，该漏洞源于程序允许普通用户访问管理用户的无线局域网配置文件。本地攻击者可通过登录受影响系统并运行命令利用该漏洞访问无线局域网配置文件（包括：密码）。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布漏洞修复程序，请及时关注更新： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8209

Reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8209

Impacted products

Name
['Microsoft Windows 10', 'Microsoft Windows 10 1607', 'Microsoft Windows Server 2016', 'Microsoft Windows 10 1703', 'Microsoft Windows 10 1709', 'Microsoft Windows Server 1709']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "104393"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-8209"
    }
  },
  "description": "Microsoft Windows 10\u7b49\u90fd\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u53d1\u5e03\u7684\u4e00\u7cfb\u5217\u64cd\u4f5c\u7cfb\u7edf\u3002Microsoft Windows 10\u662f\u4e00\u5957\u4e2a\u4eba\u7535\u8111\u4f7f\u7528\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002Windows Server 2016\u662f\u4e00\u5957\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nMicrosoft Windows Wireless Network Profile\u5b58\u5728\u672c\u5730\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5141\u8bb8\u666e\u901a\u7528\u6237\u8bbf\u95ee\u7ba1\u7406\u7528\u6237\u7684\u65e0\u7ebf\u5c40\u57df\u7f51\u914d\u7f6e\u6587\u4ef6\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u767b\u5f55\u53d7\u5f71\u54cd\u7cfb\u7edf\u5e76\u8fd0\u884c\u547d\u4ee4\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u65e0\u7ebf\u5c40\u57df\u7f51\u914d\u7f6e\u6587\u4ef6\uff08\u5305\u62ec\uff1a\u5bc6\u7801\uff09\u3002",
  "discovererName": "Microsoft",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8209",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-12574",
  "openTime": "2018-07-05",
  "patchDescription": "Microsoft Windows 10\u7b49\u90fd\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u53d1\u5e03\u7684\u4e00\u7cfb\u5217\u64cd\u4f5c\u7cfb\u7edf\u3002Microsoft Windows 10\u662f\u4e00\u5957\u4e2a\u4eba\u7535\u8111\u4f7f\u7528\u7684\u64cd\u4f5c\u7cfb\u7edf\u3002Windows Server 2016\u662f\u4e00\u5957\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u3002\r\n\r\nMicrosoft Windows Wireless Network Profile\u5b58\u5728\u672c\u5730\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u5141\u8bb8\u666e\u901a\u7528\u6237\u8bbf\u95ee\u7ba1\u7406\u7528\u6237\u7684\u65e0\u7ebf\u5c40\u57df\u7f51\u914d\u7f6e\u6587\u4ef6\u3002\u672c\u5730\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u767b\u5f55\u53d7\u5f71\u54cd\u7cfb\u7edf\u5e76\u8fd0\u884c\u547d\u4ee4\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u65e0\u7ebf\u5c40\u57df\u7f51\u914d\u7f6e\u6587\u4ef6\uff08\u5305\u62ec\uff1a\u5bc6\u7801\uff09\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Windows Wireless Network Profile\u672c\u5730\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Windows 10",
      "Microsoft Windows 10 1607",
      "Microsoft Windows Server 2016",
      "Microsoft Windows 10 1703",
      "Microsoft Windows 10 1709",
      "Microsoft Windows Server 1709"
    ]
  },
  "referenceLink": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8209",
  "serverity": "\u4f4e",
  "submitTime": "2018-06-13",
  "title": "Microsoft Windows Wireless Network Profile\u672c\u5730\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2018-8209 (GCVE-0-2018-8209)

Vulnerability from cvelistv5

Published

2018-06-14 12:00

Modified

2024-08-05 06:46

Severity ?

CWE

Information Disclosure

Summary

An information disclosure vulnerability exists when Windows allows a normal user to access the Wireless LAN profile of an administrative user, aka "Windows Wireless Network Profile Information Disclosure Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/104393	vdb-entry, x_refsource_BID
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8209	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1041101	vdb-entry, x_refsource_SECTRACK

Impacted products

Vendor

Product

Version

▼

Microsoft

Windows Server 2016

Version: (Server Core installation)

	Microsoft	Windows 10	Version: 32-bit Systems Version: Version 1607 for 32-bit Systems Version: Version 1607 for x64-based Systems Version: Version 1703 for 32-bit Systems Version: Version 1703 for x64-based Systems Version: Version 1709 for 32-bit Systems Version: Version 1709 for x64-based Systems Version: x64-based Systems
	Microsoft	Windows 10 Servers	Version: version 1709 (Server Core Installation)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:46:13.777Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "104393",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/104393"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8209"
          },
          {
            "name": "1041101",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041101"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Windows Server 2016",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "(Server Core installation)"
            }
          ]
        },
        {
          "product": "Windows 10",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Version 1607 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Version 1607 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Version 1703 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Version 1703 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Version 1709 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Version 1709 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "x64-based Systems"
            }
          ]
        },
        {
          "product": "Windows 10 Servers",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "version 1709  (Server Core Installation)"
            }
          ]
        }
      ],
      "datePublic": "2018-06-14T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An information disclosure vulnerability exists when Windows allows a normal user to access the Wireless LAN profile of an administrative user, aka \"Windows Wireless Network Profile Information Disclosure Vulnerability.\" This affects Windows Server 2016, Windows 10, Windows 10 Servers."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information Disclosure",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-06-15T09:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "104393",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/104393"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8209"
        },
        {
          "name": "1041101",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041101"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2018-8209",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Windows Server 2016",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "(Server Core installation)"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Windows 10",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "32-bit Systems"
                          },
                          {
                            "version_value": "Version 1607 for 32-bit Systems"
                          },
                          {
                            "version_value": "Version 1607 for x64-based Systems"
                          },
                          {
                            "version_value": "Version 1703 for 32-bit Systems"
                          },
                          {
                            "version_value": "Version 1703 for x64-based Systems"
                          },
                          {
                            "version_value": "Version 1709 for 32-bit Systems"
                          },
                          {
                            "version_value": "Version 1709 for x64-based Systems"
                          },
                          {
                            "version_value": "x64-based Systems"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "Windows 10 Servers",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "version 1709  (Server Core Installation)"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An information disclosure vulnerability exists when Windows allows a normal user to access the Wireless LAN profile of an administrative user, aka \"Windows Wireless Network Profile Information Disclosure Vulnerability.\" This affects Windows Server 2016, Windows 10, Windows 10 Servers."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Disclosure"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "104393",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/104393"
            },
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8209",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8209"
            },
            {
              "name": "1041101",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041101"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2018-8209",
    "datePublished": "2018-06-14T12:00:00",
    "dateReserved": "2018-03-14T00:00:00",
    "dateUpdated": "2024-08-05T06:46:13.777Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted